@mjasnikovs/pi-task 0.38.30 → 0.38.32

package/dist/shared/model-endpoint.js

@@ -10,10 +10,15 @@
  * while it runs, so only "no output AND the endpoint does not answer" counts as
  * a dead backend.
  *
- * Discovery is generic — the custom providers pi is configured with, read from
- * models.json `providers.*.baseUrl`, with no provider or server name hardcoded.
+ * Discovery is generic — no provider or server name is hardcoded anywhere here.
  * No discoverable endpoint means nothing to probe, and the guard then NEVER
  * kills: a child on a backend we cannot see gets the benefit of the doubt.
+ *
+ * `childModelEndpoints` is what the guards call; `discoverModelEndpoints` is its
+ * last resort. The difference is the point. Discovery answers "every endpoint on
+ * this machine", and `probeModelEndpoints` ORs over it, so one healthy provider
+ * says "reachable" for a child stranded on a dead one. Resolving the child's OWN
+ * model first turns that OR into a single exact question.
  */
 import * as fs from 'node:fs';
 import * as os from 'node:os';
@@ -33,6 +38,97 @@ export function discoverModelEndpoints(agentDir = path.join(os.homedir(), '.pi',
         return [];
     }
 }
+/** A `provider/id` spec as a ref, splitting on the FIRST slash. */
+function specRef(spec) {
+    if (spec === undefined)
+        return undefined;
+    const i = spec.indexOf('/');
+    if (i <= 0 || i === spec.length - 1)
+        return undefined;
+    return { provider: spec.slice(0, i), id: spec.slice(i + 1) };
+}
+export function defaultModelRef(agentDir = path.join(os.homedir(), '.pi', 'agent')) {
+    try {
+        const j = JSON.parse(fs.readFileSync(path.join(agentDir, 'settings.json'), 'utf8'));
+        const provider = j.defaultProvider;
+        const id = j.defaultModel;
+        if (typeof provider !== 'string' || provider === '')
+            return undefined;
+        if (typeof id !== 'string' || id === '')
+            return undefined;
+        return { provider, id };
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The base URL one model is served from, or `undefined` for "not configured on
+ * this machine".
+ *
+ * Two files, two shapes, and the difference is not cosmetic. `models.json` is
+ * hand-written and hangs `baseUrl` off the PROVIDER; `models-store.json` is the
+ * cached remote catalogue and hangs it off each MODEL — its provider objects are
+ * `{models, checkedAt, lastModified, etag}` with no `baseUrl` key at all. A
+ * reader that knows only the first shape sees one endpoint on a machine that has
+ * fifteen.
+ *
+ * `undefined` is the honest answer for a model pi serves from `@earendil-works/
+ * pi-ai`'s built-in catalogue, whose URLs live in that package rather than on
+ * disk. We do not import it — see the header of this file — so we say we do not
+ * know, and the caller declines to probe rather than probing something else.
+ */
+export function modelBaseUrl(ref, agentDir = path.join(os.homedir(), '.pi', 'agent')) {
+    const url = (v) => typeof v === 'string' && v.length > 0 ? v : undefined;
+    try {
+        const j = JSON.parse(fs.readFileSync(path.join(agentDir, 'models.json'), 'utf8'));
+        const p = j.providers?.[ref.provider];
+        if (p) {
+            const own = p.models?.find(m => m.id === ref.id);
+            return url(own?.baseUrl) ?? url(p.baseUrl);
+        }
+    }
+    catch {
+        /* fall through to the store */
+    }
+    try {
+        const j = JSON.parse(fs.readFileSync(path.join(agentDir, 'models-store.json'), 'utf8'));
+        return url(j[ref.provider]?.models?.find(m => m.id === ref.id)?.baseUrl);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * What to probe on behalf of one child — the endpoint that child's own model
+ * uses, not every endpoint on the machine.
+ *
+ * The bug this closes is `probeModelEndpoints`'s `.some(Boolean)`: with a live
+ * cloud provider and a dead local one, the OR answers "reachable" and the stall
+ * guard is disarmed for a child that will never speak again. Handing it ONE url
+ * makes the OR a no-op and the verdict exact.
+ *
+ * `spec` is the child's OWN `provider/id`, as carried by its argv. `undefined`
+ * means the child carries no `--model` and will resolve pi's saved default,
+ * which is then the right thing to probe. Reading the saved default for a child
+ * that IS pinned asks about the wrong server in BOTH directions: it can kill a
+ * child whose own backend is healthy, and it can leave the guard disarmed for
+ * one whose backend is dead.
+ *
+ * Two escapes, both toward never killing:
+ *  - model known, endpoint not on disk (a built-in provider) → `[]`, which
+ *    `probeModelEndpoints` reads as reachable. We cannot see that server, so we
+ *    do not get a vote. Probing some OTHER provider's url instead would import a
+ *    false positive, which is the one thing today's blind OR never does.
+ *  - no readable default → today's behaviour, unchanged.
+ */
+export function childModelEndpoints(spec, agentDir = path.join(os.homedir(), '.pi', 'agent')) {
+    const ref = specRef(spec) ?? defaultModelRef(agentDir);
+    if (!ref)
+        return discoverModelEndpoints(agentDir);
+    const url = modelBaseUrl(ref, agentDir);
+    return url === undefined ? [] : [url];
+}
 /**
  * true → at least one endpoint ANSWERED. Any HTTP status counts, because the
  * question is liveness, not correctness: probing a path that 404s still returns

package/dist/shared/reasoning-capability.d.ts

@@ -30,7 +30,7 @@
  * line-for-line identical to it, ladder included. Nothing here imports pi-ai, so
  * an upstream change will not fail a test — the two have to be re-compared.
  */
-import { type ReasoningGroup, type GroupSetting } from '../config/reasoning.js';
+import { type ChildGroup, type GroupSetting } from '../config/reasoning.js';
 /**
  * pi's own level ladder, in order — the same seven names, in the same sequence,
  * as `EXTENDED_THINKING_LEVELS` in pi-ai's models.js. The order IS the algorithm:
@@ -67,16 +67,36 @@ export declare function supportedThinkingLevels(model: ReasoningModelFacts): Lad
  * the model supports it — which is what makes the inequality a mismatch test.
  */
 export declare function clampToModel(model: ReasoningModelFacts, level: LadderLevel): LadderLevel;
-/** One group whose configured setting the connected model will not honour. */
+/** One group whose configured setting the model it runs on will not honour. */
 export interface ReasoningMismatch {
-    group: ReasoningGroup;
+    group: ChildGroup;
+    /**
+     * The model THIS GROUP runs on. Per-item, not per-warning, because groups no
+     * longer share one model: a line that opens `model "X" will not run …` while
+     * listing groups that run on Y is itself a lie about what it checked.
+     */
+    modelName: string;
     /** What /task-config says. Never `inherit` — an inherited group asks for nothing. */
     wanted: LadderLevel;
     /** What pi will send instead. */
     actual: LadderLevel;
 }
+/** What a group runs on, as much of it as this check needs. */
+export interface GroupModelFacts extends ReasoningModelFacts {
+    /** What to call it in the warning. */
+    name: string;
+    /** Where it is served from, for the `/props` probe. Absent ⇒ not probeable. */
+    baseUrl?: string;
+}
 /**
- * Every group whose setting the model will silently change.
+ * Every group whose setting the model IT RUNS ON will silently change.
+ *
+ * `modelFor` is a FUNCTION rather than a `Record`, for two reasons: a record
+ * would build eleven identical entries for the overwhelmingly common
+ * all-`inherit` case, and a function is drivable from a test with two literals.
+ * It answers `undefined` for a group whose model cannot be resolved — nothing is
+ * reported for those, because the run degrades to the session default and the
+ * separate model hint is what names them.
  *
  * `inherit` groups are skipped entirely, because an inherited group asks for
  * nothing. That is not the same as a quiet default: the shipped table is mostly
@@ -91,4 +111,4 @@ export interface ReasoningMismatch {
  * comparison. Warning about one direction while staying silent about the other
  * would ship this feature unable to see its own failure mode.
  */
-export declare function reasoningMismatches(model: ReasoningModelFacts | undefined, levels: Readonly<Record<ReasoningGroup, GroupSetting>>): ReasoningMismatch[];
+export declare function reasoningMismatches(modelFor: (group: ChildGroup) => GroupModelFacts | undefined, levels: Readonly<Record<ChildGroup, GroupSetting>>): ReasoningMismatch[];

package/dist/shared/reasoning-capability.js

@@ -30,7 +30,7 @@
  * line-for-line identical to it, ladder included. Nothing here imports pi-ai, so
  * an upstream change will not fail a test — the two have to be re-compared.
  */
-import { REASONING_GROUPS } from '../config/reasoning.js';
+import { CHILD_GROUPS } from '../config/reasoning.js';
 /**
  * pi's own level ladder, in order — the same seven names, in the same sequence,
  * as `EXTENDED_THINKING_LEVELS` in pi-ai's models.js. The order IS the algorithm:
@@ -87,7 +87,14 @@ export function clampToModel(model, level) {
     return available[0] ?? 'off';
 }
 /**
- * Every group whose setting the model will silently change.
+ * Every group whose setting the model IT RUNS ON will silently change.
+ *
+ * `modelFor` is a FUNCTION rather than a `Record`, for two reasons: a record
+ * would build eleven identical entries for the overwhelmingly common
+ * all-`inherit` case, and a function is drivable from a test with two literals.
+ * It answers `undefined` for a group whose model cannot be resolved — nothing is
+ * reported for those, because the run degrades to the session default and the
+ * separate model hint is what names them.
  *
  * `inherit` groups are skipped entirely, because an inherited group asks for
  * nothing. That is not the same as a quiet default: the shipped table is mostly
@@ -102,19 +109,21 @@ export function clampToModel(model, level) {
  * comparison. Warning about one direction while staying silent about the other
  * would ship this feature unable to see its own failure mode.
  */
-export function reasoningMismatches(model, levels) {
-    // No model resolved yet (session still starting, or none selected): say
-    // nothing. A warning naming no model is noise, not information.
-    if (!model)
-        return [];
+export function reasoningMismatches(modelFor, levels) {
     const out = [];
-    for (const group of REASONING_GROUPS) {
+    for (const group of CHILD_GROUPS) {
         const wanted = levels[group];
         if (wanted === 'inherit')
             continue;
+        // No model resolved for this group (session still starting, none
+        // selected, or a spec this machine cannot resolve): say nothing. A
+        // warning naming no model is noise, not information.
+        const model = modelFor(group);
+        if (!model)
+            continue;
         const actual = clampToModel(model, wanted);
         if (actual !== wanted)
-            out.push({ group, wanted, actual });
+            out.push({ group, modelName: model.name, wanted, actual });
     }
     return out;
 }

package/dist/task/auto-orchestrator.js

@@ -22,7 +22,7 @@ import { drainRepairQueue, mergeRepairCandidates, planHasRepairFor, parseRepairT
 import { writeTaskFile, readTaskFile, updateTaskFrontMatter, taskFilePath, tasksDir } from './task-io.js';
 import { readTextFile } from '../shared/fs-text.js';
 import { findPhantomImports, rewritePhantomSpecifiers } from '../workers/phantom-imports.js';
-import { prependHint, USER_CANCELLED } from './child-runner.js';
+import { isFatalChildCause, prependHint, USER_CANCELLED } from './child-runner.js';
 import { requestCancel, resetCancel, isCancelRequested, cancelCheckpoint } from './cancel-points.js';
 import { withRun, announceTerminal } from './run-bracket.js';
 import { refineExistingFilesBlock, SINGLE_READ_EXTENSION_PATH } from './phases.js';
@@ -493,8 +493,15 @@ export async function orientFeature(cwd, feature, deps) {
         reqEntries = capRequirements(reqEntries, passages, featureForModel);
         logPlanDebug(cwd, `requirement extraction: ${reqEntries.length} grounded requirement(s) kept`);
     }
-    catch {
-        // best-effort channel
+    catch (e) {
+        // Best-effort covers a child that answered badly. It must NOT cover a user
+        // ESC or a dead backend: planning would continue on an EMPTY ledger, moving
+        // the granularity floor and shipping a degraded plan instead of a cancel or
+        // a failure. Same rule as verify-resolution.ts.
+        if (isFatalChildCause(e))
+            throw e;
+        // Best-effort, but not silent: nothing else records a guard kill here.
+        logPlanDebug(cwd, `requirement extraction: skipped — ${e.message}`);
     }
     // Granularity floor: without it the plan's task COUNT is set by an
     // auto-resolved clarify line the user never sees, so the same spec and the same
@@ -1101,8 +1108,12 @@ function defaultDeps(ctx, cwd, signal, title) {
     const status = new ChildStatus({ parentContextWindow });
     const phaseDeps = {
         cwd,
+        // No task file, so appendLoopEvent swallows its ENOENT. Its docblock
+        // allows that because "the kill is already reported through the debug
+        // log" — which is why logDebug below is not optional here.
         taskId: '',
         signal,
+        logDebug: msg => logPlanDebug(cwd, msg),
         // IN-RUN thrash guard for the planning children: without it a decompose
         // child can re-read its design document until it fills the whole context
         // window, and never return. Every planning child

package/dist/task/child-runner.d.ts

@@ -6,15 +6,14 @@
  * for phase-level child pi invocations.
  */
 import { type SpawnFn, type ContextSnapshot, type ToolCall, type LoopHit } from '../shared/child-process.js';
+import { type CommandKill } from '../shared/command-watchdog.js';
+import { type WorkerGuardPolicy } from '../workers/worker-profiles.js';
 import type { DebugLine } from './debug-log.js';
 import type { RunWorkerInput, RunWorkerResult } from '../workers/pi-worker-core.js';
 import type { docsRaw, docsFocused } from '../workers/docs-core.js';
 import type { fetchRaw, fetchFocused } from '../workers/fetch-core.js';
 import type { npmVersionLookup } from '../workers/npm-version.js';
 import type { SearchCoreInput, SearchCoreResult } from '../workers/search-core.js';
-export declare const LOOP_WINDOW = 20;
-export declare const LOOP_THRESHOLD = 5;
-export declare const MAX_LOOP_RESTARTS = 2;
 /**
  * Optional wall-clock bound on ONE spawn of a phase child. DEFAULT: OFF.
  *
@@ -50,6 +49,53 @@ export declare class PhaseTimeoutError extends Error {
     readonly attempts: number;
     constructor(childName: string, budgetMs: number, attempts: number);
 }
+/**
+ * The terminal error for a guard kill, or null when the child was not killed.
+ *
+ * Both spawn paths must ask. A kill reports `exitCode: 0` (child-process.ts uses
+ * `code ?? 0`, and a signal gives null), so a path that tests the exit code
+ * instead returns the truncated text as the phase's answer.
+ */
+export declare function guardKillError(name: string, r: PhaseRunResult, opts?: {
+    finalAttempt?: boolean;
+}): Error | null;
+/**
+ * The dead-backend probe killed a phase child on its LAST attempt.
+ *
+ * Reaching this means every attempt found no endpoint answering, not one. The
+ * single-probe verdict is not trusted on its own, because one sample cannot tell
+ * a dead server from a blip. Three failed probes cost ~15s; one wrong verdict
+ * costs the run.
+ */
+export declare class BackendDownError extends Error {
+    readonly childName: string;
+    constructor(childName: string);
+}
+/**
+ * A phase child spent every attempt on a command that never returned. Its own
+ * class because the fix is in the SPEC, not the model's exploration: a VERIFY
+ * block naming an unbounded `dev` command re-hangs every attempt.
+ */
+export declare class CommandTimeoutError extends Error {
+    readonly childName: string;
+    readonly kill: CommandKill;
+    constructor(childName: string, kill: CommandKill);
+}
+/**
+ * Causes a best-effort `catch` must NOT absorb.
+ *
+ * A phase child that merely answered badly should degrade — that is what those
+ * catches are for. These two are different in kind: the run is over either way,
+ * and swallowing them ships a half-built spec while every later phase dies
+ * against the same dead backend, or turns a user's ESC into silent progress.
+ * `failure-classifier.ts` has a verdict for both; a catch that eats them makes it
+ * unreachable.
+ */
+export declare function isFatalChildCause(e: unknown): boolean;
+/**
+ * Retry budget is three attempts at 500ms/1s/2s — three requests over 3.5s, which
+ * is not a storm even against a throttle. pi's own ladder is three at 2s/4s/8s.
+ */
 export declare function isConnectionError(cause: string): boolean;
 /** Exponential backoff before a connection-error retry: 500ms, 1s, 2s, …, so a
  *  brief saturation window can drain before we re-issue the request. */
@@ -63,15 +109,31 @@ export interface PhaseRunResult {
     leakedToolCall?: string;
     /** Set when the child's final turn failed with stopReason "error" (model/provider failure). */
     modelError?: string;
+    /**
+     * Set when the per-command watchdog killed the child: one tool call outran
+     * `requestTimeoutMs`. RESTARTABLE (worker-kill.ts) — a hung command is a
+     * mistake the next attempt can be told not to repeat.
+     */
+    commandKill?: CommandKill;
+    /**
+     * Set when the dead-backend probe killed the child: no output for the stall
+     * window AND the model endpoint unreachable. NOT restartable (worker-kill.ts):
+     * re-spawning against a backend that is down buys nothing.
+     */
+    stalled?: boolean;
 }
 export declare function childArgs(tools: string, extensions?: readonly string[], 
 /**
- * An already-resolved `['--thinking', level]`, or `[]` for "emit no flag".
- * Resolved by the CALLER, never here: the level is a property of the child's
- * ROLE, and this function is handed tools and extensions, not a name.
- * Omitted ⇒ byte-identical argv to the version before reasoning profiles.
+ * This child's group fragment: `--model` then `--thinking`, either half
+ * possibly absent. Resolved by the CALLER, never here — both are properties
+ * of the child's ROLE, and this function is handed tools and extensions, not
+ * a name. Omitted ⇒ byte-identical argv to the version before group profiles.
+ *
+ * ONE field rather than a `model` beside a `thinking`, because nothing may
+ * compose the two halves by hand: `groupChildArgs` is the only producer, so a
+ * doubled `--thinking` is unreachable rather than merely unlikely.
  */
-thinking?: readonly string[]): string[];
+groupArgs?: readonly string[]): string[];
 export declare const USER_CANCELLED = "__user_cancelled__";
 /**
  * Run a child pi process with JSON event-stream output, loop detection, and
@@ -116,12 +178,27 @@ export interface ChildRun {
      */
     contextWindow?: number;
     /**
-     * The resolved `['--thinking', level]` fragment for this child's reasoning
-     * group, or `[]`/omitted to inherit the session default as before.
+     * The resolved argv fragment for this child's group — `--model` then
+     * `--thinking` — or `[]`/omitted to inherit both defaults as before.
+     */
+    groupArgs?: readonly string[];
+    /**
+     * This attempt's per-command ceiling, already halved for prior hangs by the
+     * caller's strike loop. Omitted -> the `phase` row's full configured ceiling,
+     * which is the right value for a single-attempt caller.
      */
-    thinking?: readonly string[];
+    commandCeilingMs?: number;
 }
-export declare function runChild({ cwd, tools, prompt, signal, onLine, onContextUsage, onToolCall, spawn: spawnFn, extensions, onToolResult, contextWindow, thinking }: ChildRun): Promise<PhaseRunResult>;
+/**
+ * The `phase` row of WORKER_PROFILES, resolved with this machine's config.
+ *
+ * Read here rather than at module load so a /task-config change reaches the next
+ * child, the same contract childBaseArgs already keeps. Both spawn paths in this
+ * file go through it, so the degraded final attempt cannot drift from the ordinary
+ * one — the mislabel class runDegradedFinalAttempt's own comment warns about.
+ */
+export declare function phasePolicy(): WorkerGuardPolicy;
+export declare function runChild({ cwd, tools, prompt, signal, onLine, onContextUsage, onToolCall, spawn: spawnFn, extensions, onToolResult, contextWindow, groupArgs, commandCeilingMs }: ChildRun): Promise<PhaseRunResult>;
 export interface PhaseDeps {
     cwd: string;
     taskId: string;
@@ -263,15 +340,15 @@ export type PhaseSeams = Omit<PhaseDeps, 'cwd' | 'taskId' | 'signal' | 'onChildO
  * exit status describes our SIGTERM and says nothing about its verdict.
  */
 /**
- * The `--thinking` fragment for a named child, or `[]` when the name is unmapped.
+ * The group fragment for a named child, or `[]` when the name is unmapped.
  *
  * An unmapped name INHERITS rather than throwing: a child that reaches the model
  * with today's argv is always safe, and aborting a user's task over a missing
  * table row would be a worse failure than the one it reports. The guard that
- * makes the table complete is `reasoning-groups.test.ts`, which fails the BUILD —
+ * makes the table complete is `config/groups.test.ts`, which fails the BUILD —
  * where someone can actually fix it.
  */
-export declare function thinkingForChild(name: string): string[];
+export declare function groupArgsForChild(name: string): string[];
 export declare function runPhaseChild(deps: PhaseDeps, name: string, tools: string, prompt: string, opts?: PhaseChildOptions): Promise<string>;
 export declare function formatLoopHint(hit: LoopHit): string;
 /**